External risk intelligence

ManageEngine Analytics Plus Unauthenticated SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-8324

ManageEngine Analytics Plus is an enterprise-grade business intelligence and analytics platform. These solutions are frequently deployed as web-based applications intended to be accessible to various users across a network, and in many organizational deployments, such analytical dashboards and reporting portals are exposed to the internet or edge networks to facilitate remote access and collaboration.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in ManageEngine Analytics Plus, a business intelligence and analytics platform. The issue, an SQL injection vulnerability, could allow unauthorized access and manipulation of data if not properly addressed. The primary concern is to confirm if this product is in use and assess any potential exposure.

Unauthenticated SQL injection in analytics software.
Impacts sensitive data access and integrity.
Confirm relevance and scope of exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted SQL queries over the network to the affected application. Because the vulnerability is unauthenticated and exposed externally, an attacker would not need any prior access to the system to trigger it. Successfully exploiting this flaw could allow an attacker to execute arbitrary SQL commands, potentially leading to unauthorized access, modification, or deletion of sensitive data.

Unauthenticated network access required.
Improperly filtered SQL input triggers vulnerability.
Risk of unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject SQL commands into ManageEngine Analytics Plus. This could potentially lead to unauthorized access, modification, or deletion of sensitive data stored within the application's database. The attack vector is network-based, meaning it can be exploited remotely without any required user interaction.

Database contents could be exposed.
Unauthenticated network access is possible.
Unauthorized data access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Unauthenticated SQL injection in ManageEngine Analytics Plus versions prior to 6170 presents a critical risk. Application owners and infrastructure teams are primarily responsible for addressing this vulnerability. The initial and most critical step is to identify all instances of the affected software, assess their exposure, and determine business criticality to prioritize remediation efforts.

Application owners should manage the remediation process.
Verify external accessibility and business criticality first.
Plan and coordinate vendor-supported updates or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ManageEngine Analytics Plus?

ManageEngine Analytics Plus is an enterprise-grade business intelligence and analytics platform. Organizations use it to visualize data, create interactive dashboards, and generate reports from various data sources. It is designed to act as a centralized hub for data analysis, often serving as a web-based portal where users across a company can access and collaborate on critical business insights.

What does SQL injection mean in the context of CVE-2025-8324?

This vulnerability is classified as Improper Neutralization of Special Elements used in an SQL Command (CWE-89). Essentially, the software fails to properly filter or clean input from users before processing it in a database query. Because of this flaw, a malicious actor can insert their own database commands into the application, tricking it into executing unauthorized instructions instead of simply processing data.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted, malicious SQL commands over the network to the application. Because the vulnerability does not require any prior authentication, the attacker does not need a username or password to initiate the attack. Crucially, legitimate administrative tasks performed by authorized users within the application interface do not trigger this issue; it is specifically the unauthenticated network-based input that is dangerous.

Is my instance of Analytics Plus at risk?

According to Halo Surface Signal, this software is frequently deployed as a web-based application intended for broad user access. Many organizations choose to place these analytical dashboards on internet-facing or edge networks to support remote collaboration. If your instance is reachable from the public internet, it falls into the classification of being externally exposed, significantly increasing the likelihood that it could be targeted.

What should I do if I am running this software?

The immediate priority is to locate all instances of Analytics Plus within your environment and verify their version numbers. Since versions 6170 and below are affected, you should coordinate with your infrastructure teams to plan and apply the necessary vendor-provided updates. Focus your efforts on internet-facing systems first, as these present the highest risk of unauthorized access due to the network-based nature of this flaw.

References

www.manageengine.com/analytics-plus/CVE-2025-8324.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.